{"id":21790,"date":"2020-02-10T10:42:49","date_gmt":"2020-02-10T18:42:49","guid":{"rendered":"https:\/\/lapost.us\/?p=21790"},"modified":"2020-02-10T10:42:49","modified_gmt":"2020-02-10T18:42:49","slug":"chinese-military-personnel-charged-with-computer-fraud-economic-espionage-and-wire-fraud-for-hacking-into-credit-reporting-agency-equifax","status":"publish","type":"post","link":"https:\/\/lapost.us\/?p=21790","title":{"rendered":"Chinese Military Personnel Charged with Computer Fraud, Economic Espionage and Wire Fraud for Hacking into Credit Reporting Agency Equifax"},"content":{"rendered":"
\n
\n
\n
Indictment Alleges Four Members of China\u2019s People\u2019s Liberation Army Engaged in a Three-Month Long Campaign to Steal Sensitive Personal Information of Nearly 150 Million Americans<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n

A federal grand jury in Atlanta returned an indictment last week charging four members of the Chinese People\u2019s Liberation Army (PLA) with hacking into the computer systems of the credit reporting agency Equifax and stealing Americans\u2019 personal data and Equifax\u2019s valuable trade secrets.<\/p>\n

The nine-count indictment alleges that Wu Zhiyong (\u5434\u5fd7\u52c7), Wang Qian (\u738b\u4e7e), Xu Ke
(\u8bb8\u53ef) and Liu Lei (\u5218\u78ca) were members of the PLA\u2019s 54th<\/sup>\u00a0Research Institute, a component of the Chinese military. \u00a0They allegedly conspired with each other to hack into Equifax\u2019s computer networks, maintain unauthorized access to those computers, and steal sensitive, personally identifiable information of approximately 145 million American victims.<\/p>\n

\u201cThis was a\u00a0deliberate and sweeping\u00a0intrusion\u00a0into the private information of the American people,\u201d said Attorney General William P. Barr, who made the announcement.\u00a0\u201cToday, we hold PLA hackers accountable for their criminal actions, and we remind the Chinese government that we have the capability to remove the Internet\u2019s cloak of anonymity\u00a0and find\u00a0the hackers that nation repeatedly deploys\u00a0against\u00a0us.\u00a0Unfortunately, the Equifax hack fits a disturbing and unacceptable pattern of state-sponsored computer intrusions and thefts by China\u00a0and its\u00a0citizens that\u00a0have targeted personally\u00a0identifiable information, trade secrets,\u00a0and other confidential\u00a0information.\u201d<\/p>\n

According to the indictment, the defendants exploited a vulnerability in the Apache Struts Web Framework software used by Equifax\u2019s online dispute portal. \u00a0They used this access to conduct reconnaissance of Equifax\u2019s online dispute portal and to obtain login credentials that could be used to further navigate Equifax\u2019s network. \u00a0The defendants spent several weeks running queries to identify Equifax\u2019s database structure and searching for sensitive, personally identifiable information within Equifax\u2019s system. \u00a0Once they accessed files of interest, the conspirators then stored the stolen information in temporary output files, compressed and divided the files, and ultimately were able to download and exfiltrate the data from Equifax\u2019s network to computers outside the United States. In total, the attackers ran approximately 9,000 queries on Equifax\u2019s system, obtaining names, birth dates and social security numbers for nearly half of all American citizens.<\/p>\n

The indictment also charges the defendants with stealing trade secret information, namely Equifax\u2019s data compilations and database designs. \u00a0\u201cIn short, this was an organized and remarkably brazen criminal heist of sensitive information of nearly half of all Americans, as well as the hard work and intellectual property of an American company, by a unit of the Chinese military,\u201d said Barr.<\/p>\n

The defendants took steps to evade detection throughout the intrusion, as alleged in the indictment. \u00a0They routed traffic through approximately 34 servers located in nearly 20 countries to obfuscate their true location, used encrypted communication channels within Equifax\u2019s network to blend in with normal network activity, and deleted compressed files and wiped log files on a daily basis in an effort to eliminate records of their activity.<\/p>\n

\u201cToday\u2019s announcement of these indictments further highlights our commitment to imposing consequences on cybercriminals no matter who they are, where they are, or what country\u2019s uniform they wear,\u201d said FBI Deputy Director David Bowdich.\u00a0 \u201cThe size and scope of this investigation \u2014 affecting nearly half of the U.S. population, demonstrates the importance of the FBI\u2019s mission and our enduring partnerships with the Justice Department and the U.S. Attorney\u2019s Office.\u00a0 This is not the end of our investigation; to all who seek to disrupt the safety, security and confidence of the global citizenry in this digitally connected world, this is a day of reckoning.\u201d<\/p>\n

The defendants are charged with three counts of conspiracy to commit computer fraud, conspiracy to commit economic espionage, and conspiracy to commit wire fraud. \u00a0The defendants are also charged with two counts of unauthorized access and intentional damage to a protected computer, one count of economic espionage, and three counts of wire fraud.<\/p>\n

The investigation was conducted jointly by the U.S. Attorney\u2019s Office for the Northern District of Georgia, the Criminal and National Security Divisions of the Department of Justice, and the FBI\u2019s Atlanta Field Office.\u00a0 The FBI\u2019s Cyber Division also provided support.\u00a0 Equifax cooperated fully and provided valuable assistance in the investigation.<\/p>\n

Assistant U.S. Attorneys Nathan Kitchens, Samir Kaushal, and Thomas Krepp of the Northern District of Georgia; Senior Counsel Benjamin Fitzpatrick of the Criminal Division\u2019s Computer Crime and Intellectual Property Section; and Trial Attorney Scott McCulloch of the National Security Division\u2019s Counterintelligence and Export Control Section are prosecuting this case. \u00a0Attorneys with the Office of International Affairs provided critical assistance in obtaining evidence from overseas.<\/p>\n

The details contained in the charging document are allegations.\u00a0 The defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.<\/p>\n

The year 2020 marks the 150th anniversary of the Department of Justice.\u00a0 Learn more about the history of our agency at\u00a0www.Justice.gov\/Celebrating150Years<\/u><\/a>.<\/p>\n<\/div>\n<\/div>\n<\/div>\n

\n
\n
Attachment(s):<\/div>\n
\n
Download Wu Zhiyong Indictment<\/a><\/span><\/div>\n<\/div>\n<\/div>\n
\n
Topic(s):<\/div>\n
\n
Consumer Protection<\/div>\n
Cyber Crime<\/div>\n
Financial Fraud<\/div>\n
Counterintelligence and Export Control<\/div>\n<\/div>\n<\/div>\n
\n
Component(s):<\/div>\n
\n
Criminal Division<\/a><\/div>\n
Criminal – Computer Crime and Intellectual Property Section<\/a><\/div>\n
Criminal – Office of International Affairs<\/a><\/div>\n
Federal Bureau of Investigation (FBI)<\/a><\/div>\n
National Security Division (NSD)<\/a><\/div>\n
Office of the Attorney General<\/a><\/div>\n
USAO – Georgia, Northern<\/a><\/div>\n<\/div>\n<\/div>\n
\n
Press Release Number:<\/div>\n
\n
20-157<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
Updated February 10, 2020<\/div>\n","protected":false},"excerpt":{"rendered":"

Indictment Alleges Four Members of China\u2019s...<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,7],"tags":[],"class_list":["post-21790","post","type-post","status-publish","format-standard","hentry","category-china","category-u-s-a"],"_links":{"self":[{"href":"https:\/\/lapost.us\/index.php?rest_route=\/wp\/v2\/posts\/21790","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lapost.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lapost.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lapost.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lapost.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=21790"}],"version-history":[{"count":1,"href":"https:\/\/lapost.us\/index.php?rest_route=\/wp\/v2\/posts\/21790\/revisions"}],"predecessor-version":[{"id":21791,"href":"https:\/\/lapost.us\/index.php?rest_route=\/wp\/v2\/posts\/21790\/revisions\/21791"}],"wp:attachment":[{"href":"https:\/\/lapost.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21790"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lapost.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21790"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lapost.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21790"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}